Trivy under attack again: Widespread GitHub Actions tag compromise secrets

TL;DR Highlight

75 of Trivy vulnerability scanner's official GitHub Action tags were replaced with malicious code via force-push, exposing 10,000+ CI/CD pipelines to credential theft of AWS/GCP/Azure secrets and SSH keys.

Who Should Read

DevOps and backend developers running CI/CD pipelines with GitHub Actions who use security scanners like Trivy. If your team references aquasecurity/trivy-action by version tag, check immediately.

Core Mechanics

Attackers force-pushed 75 of 76 version tags in the aquasecurity/trivy-action repository to malicious commits. Commonly used tags like @0.34.2, @0.33.0, @0.18.0 were all affected — @0.35.0 is currently the only safe tag.
The malicious payload runs in GitHub Actions runner environments, dumping runner process memory to extract secrets, collecting SSH keys, and exfiltrating AWS/GCP/Azure credentials and Kubernetes service account tokens.
The attack's sophistication lies in force-pushing existing tags rather than creating new branches or releases. This method barely shows up in commit history and doesn't trigger notifications, making detection difficult.
The root cause traces back to credentials stolen during the early March OpenVSX VS Code extension compromise. The Trivy team rotated secrets, but the rotation wasn't atomic — the attacker is believed to have maintained access to newly issued tokens.
Over 10,000 workflow files reference this Action on GitHub, and the malicious code runs before the legitimate Trivy scan starts, making it hard for users to notice anything unusual.
Additional damage was confirmed on Docker Hub. Malicious Trivy image tags 0.69.4, 0.69.5, 0.69.6 were discovered on March 22, and the latest tag also pointed to the malicious image during the exposure window.
Socket's AI scanner detected this campaign in real-time starting March 20 at 19:15 UTC, generating 182 threat feed entries, all correctly classified as Backdoor/Infostealer/Reconnaissance malware.
This is the second supply chain compromise in the Trivy ecosystem within the same month of March. Credentials stolen in the first breach were not fully neutralized and were reused in the second attack.

Evidence

GitHub's official security guidelines recommend pinning Actions to full commit SHAs rather than version tags. This prompted suggestions that GitHub should enforce immutable version policies for Actions to prevent this class of attack entirely.
Community questions arose about the specific failure in the credential rotation process. 'Given the second breach on March 22, it appears the attacker maintained access through two credential rotations.' With various GitHub token types (PAT, OAuth, GitHub App tokens), the exact type compromised remained unclear.
Criticism of granting excessive permissions to security scanners emerged. One working developer said 'Security teams keep introducing new scanners demanding full codebase or cloud access — if I'd granted even 10% of those requests, we'd have been breached multiple times already,' warning about security tool supply chain risks.
A developer apparently directly affected shared 'I'll probably spend the next few weeks writing dozens of reports and sitting through countless meetings,' expressing frustration that Trivy had been compromised twice.
Practical advice like 'always run these tools in sandboxes to limit blast radius' was shared. Others noted this case should dispel the notion that only npm is targeted by supply chain attacks.

How to Apply

If you reference aquasecurity/trivy-action by version tag (@0.34.2, etc.), review your workflow files immediately. Pin to a trusted commit's full SHA (e.g., uses: aquasecurity/trivy-action@commitSHA) instead — this protects against tag force-push replacements.
If any workflow using aquasecurity/trivy-action ran after March 20, 19:15 UTC, immediately rotate all secrets used in that pipeline (AWS keys, GCP service accounts, Azure credentials, SSH keys, Kubernetes tokens). Beyond rotation, audit access logs for resources accessible with the old credentials.
Minimize permissions granted to security scanners and third-party Actions in CI/CD pipelines. Restrict GITHUB_TOKEN permissions to read-only at the workflow level, and use OIDC (temporary token-based auth) for cloud credentials to limit the validity window of stolen credentials.
Use tools like Socket, Dependabot, or Renovate to monitor GitHub Actions dependencies — they can detect tag replacements with malicious commits in real-time. Socket detected this attack live and classified it as Backdoor/Infostealer.

Code Example

snippet

# Vulnerable approach: version tag reference (can be replaced via force-push)
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@0.34.2  # ❌ Dangerous

# Safe approach: pinned to full commit SHA (immutable)
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@a20de5420d57c4102547773ee84a9575c8d547ea  # ✅ Safe

# GitHub Actions minimum permission configuration example
permissions:
  contents: read       # Grant minimum permissions only
  security-events: write  # Only if needed for Trivy SARIF upload

# Temporary AWS credentials via OIDC (minimizes damage if compromised)
- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@commitSHA
  with:
    role-to-assume: arn:aws:iam::ACCOUNT:role/ROLE
    aws-region: ap-northeast-2
    # Do not hardcode access-key-id/secret-access-key

Terminology

force-pushForcibly overwriting a remote repository's history in Git. Normal pushes add new commits, but force-push replaces existing history entirely, enabling stealthy tag replacement.

Supply Chain AttackAttacking the tools/libraries/services you trust and use rather than attacking your code directly. Poisoning the supply chain to target end users.

InfostealerA type of malware that silently collects sensitive information (passwords, API keys, cookies, SSH keys) from infected environments and transmits them to attacker servers.

Atomic rotationWhen multiple steps of an operation either all succeed or all fail as one unit. If credential rotation isn't atomic, partially rotated states create windows for attackers to intercept new credentials.

OIDC (OpenID Connect)A method of accessing cloud services (AWS, GCP, etc.) using temporary tokens instead of long-lived API keys. Even if tokens are stolen, their short validity window limits damage.

blast radiusThe scope affected by a security incident or system failure. Like an explosion radius, minimizing this is a core goal of security design.